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2013 Toyota 4 Runner 


The Toyota “G” 
transponder, over 
the TR47 keyway is 
common to many 
2010+ vehicles, it 
is repeated in the 
2013 4Runner. The 
4Runner uses the 
new Cut Spacing 
convention (paired 
wafers). This article 
will illustrate the 
opening procedure, 
disassembly, cylinder 
removal and methods 
for originating a “first 
key” for this vehicle. 


The 2013 4Runner 
(SR5) has four lock 
cylinders. There is a 
cylinder in the drivers’ 
door, Ignition, Glove 
Box, and Rear Hatch. 
The ignition cylinder 
will contain tumblers 
in positions 1-10. The 
door cylinder contains 
tumblers in positions 
3-10. The glove box 
cylinder contains 
tumblers in 
positions 7-10, 
plus a wafer at 
the tip, which 
is the “V” Valet 
tumbler. The 
rear hatch 
cylinder contains 
tumblers in 


positions 3-10. There is provision for a “V” Valet 
tumbler in the hatch cylinder, but no wafer was 
found in this position. All cylinders are “keyed- 
alike,” from the factory. The TR47 key normally 
carries ten bitting positions and a “Tip” Valet 
position. The fastest and most satisfactory method 
of making these keys has been to remove the door 
cylinder to make a working door key from the code 
found on this cylinder. “Sight Reading” the door 
cylinder is extremely difficult, as these cylinders 
employ the “stepped wafer ear” to disguise the 
bitting heights. Picking to decode (using a Lishi 
2-in-1 pick decoder) plus code search or progression 
may also be viable solution, but the code is on the 
cylinder, and it is 
easier removed 
than picking 
to decode. The 
door cylinder 
can be easily 
removed from 
the outside 
the door. It is 
unnecessary 
to remove the 
door trim panel 
or remove the 
handle assembly 
to free the door 
cylinder. The 
code is stamped 
on the side of the 
cylinder. Codes 
were not found 
on any other 
cylinders. The 
ignition cylinder 
is “column 
mounted,” 
with an active 
retainer. 


The first step in any service procedure must 
be to determine the “model year” of the vehicle. 
The 10th digit of the VIN number will reveal the 
model year. The VIN number will be found on a 
sticker label in the driver’s door channel. The “Date 
of Manufacture” (upper right corner) is “09/12.” 
This may be important on vehicles that have a 
variant “upgrade or update” during the model year. 
(The last four digits of the VIN number have been 
obscured for security reasons.) The 10th digit of 
the Vin is a “D.” This is a 2013 model vehicle. (See 
Figure 1.) 


A metal tag, in the lower left corner of the 
windshield also shows the VIN number for this 
vehicle. The 10th digit of the VIN number is “D,” 
confirming this to be a 2014 model auto. (See Figure 
2.) 


From the Fast Facts “index,” we find Key Plate 
“TO18,” for the 2010-2014 FJ Cruiser. This Key Plate 
applies to the majority of the 2010+ Toyota Vehicles 
that use the TR47 key blade and “G” transponder. 
The Key plate shows: tumbler locations, depth and 
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space information, code series and the correct key 
blade for this vehicle. The key shown is the Toyota 
original (non-IKT) blank. ILCO and Jet “head styles” 
may vary. The only difference is the corporate 
“Head Mark.” 


From the Fast Facts™ Key Plate we find: 


Code Series: 50000-69999 


Keys: 
OEM# 89785-08040, ILCO: 
TOY44G-PT & Jet: TR52G-PHT 


Work Key: 
X217, X225 & TR47 


Key is Gauged: 
Tip Gauged 


Space 
Depth 


1- 
.846 
1- 
.325 


2- 
.791 
2- 
.299 


3- 
.709 
3- 
.274 


4- 
.654 
4- 
.248 


5- 
.571 


6 
.516 
the step increment is: .0255 


7- 
.433 


8- 
.378 


9- 
.295 


10- 
.240 


Tumbler Locations 


Ignition: 
1-10 


Door: 
3-10 


Trunk (Rear Hatch) 
3-10+ (+ = Valet tumbler) 


Glove Box: 
7-10+ (+ = Valet 
tumbler) 


Other important key making information is 
found on this Key Plate, but the above is the most 
important, along with the key making suggestions 
in the lower left corner of the plate. Most important 
is; “code-pass dr cyl.” The code is found on the 
passenger door cylinder. (See Figure 3.) 


If you will be making this key on a Framon #2 
Code Machine, the “Framon Spacing” specifications 
are given in the information block of the Fast Facts 
Key Plate. 


The Fast Facts Key Plate calls for HPC 1200CM 
Code Card #XF307. The CF307 Card is the same. It 
was printed from the InstaCode Code Program. This 
card requires the CW-47MC cutter. (See Figure 4.) 


3. 


4. 


5. 
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A horizontal “rocker style” lock button 
(mechanical lock control) is located above the latch 
release handle in the door. Carefully wedge the top 
rear corner of the door with an “air-wedge” to create 
an opening for a “long-reach” opening tool. Drag the 
button rearward to unlock the door. Alternately, it is 


possible to press the electric lock control button, to 
unlock the vehicle. If the vehicle is running, press 
one of the window control buttons to run a window 
down. (See Figure 5.) 


The door cylinder is incorporated into the drivers 
door pull handle trim. It is retained by a screw 
fastener, accessible from the rear edge of the door. 
The trim is plastic. (See Figure 6.) 


The rear edge of the drivers’ door shows a 
Plastic Plug. Remove the plug to reveal the Cylinder 
Retaining Screw. A T-30 Torx driver will loosen this 
screw to free the door cylinder. The screw head 
is retained in the plastic housing, to prevent its 
complete removal. Do not “remove” the screw from 
the door. (See Figure 7.) 


When the screw is backed out far enough to 
release the cylinder, it can be easily removed. 
Carefully remove the door cylinder. (See Figure 8.) 


This shows the location of the cylinder Retaining 
Screw. (See Figure 9.) 


With the cylinder removed, the code is easily 
located on the rib of the cylinder body. The Code 
is: 68076. A quick code “look-up” will find the 


6. 


7. 


8. 
9. 


10. 


National Locksmith Automobile Association 
Issue­No.­151­•­­5 


bitting: 4334233221. Cut this key using the CF307 
Code Card and CW-47MC Cutter to complete the 
mechanical portion of the key making process. 
If the combination has been changed or the code 
number cannot be found continue, to disassemble 
the cylinder. (See Figure 10.) 


The plastic cylinder trim is retained by three trim 
latches. The front latch is a stirrup catch. Carefully 
lift the stirrup with a small flat-blade screwdriver to 
disengage the front latch. Lift the trim at the front 
to disengage the rear latch ears. Remove the plastic 
trim. Remove the Plug Retainer and Centering 
Spring. An “easy-off” chrome Scalp is pried off the 
front of the cylinder to free the plug for removal. 
The wafers are not retained in the plug, so use care 
as you remove the Plug. (See Figure 11.) 


This is an exploded view of the door cylinder 
components. Notice the Rubber Pellet at the front 
of the actuator. It holds the actuator in alignment as 
it is inserted into the door latch assembly. It is also 
an “anti-rattle” component. Don’t forget to replace it, 


as you see, when the cylinder is reassembled. (See 
Figure 12.) 


The door cylinder has 8 wafers, in positions 3-10. 
Note the “paired-wafer” configuration. Wafers 3/4, 
5/6, 7/8 and 9/10 share wafer compartments in the 
plug. (See Figure 13.) 


The wafers are numbered to indicate the correct 
bittings. The numbering, however, is “backwards.” 
A tumbler labeled “1,” will use a #4 bitting depth 
(deepest). A tumbler labeled “4,” will use a #1 
bitting depth (shallowest). This shows a simple 
conversion table for converting the labeled numbers 
to the correct bitting depths. The top and bottom 
wafers are arranged to show their positions in the 
plug. They are labeled to indicate their number and 
Bitting. The Bitting for this cylinder is 3 4 2 3 3 2 2 1, 
from Bow to Tip, for positions 3-10. (See Figure 14.) 


Using the above bittings and the “missing cut” 
utility of the InstaCode program the code series 
returns nine (9) possible bitting combinations 


11. 


12. 


13. 


14. 
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to complete the key. This may be an option for 
completing the key. 


The Glove Box lock is mounted to the dash, and 
is located at the top left corner of the glove box. 
The Glove box is secured by spring latch bolts at 
the top left and right sides of the lid. The latches 
are interconnected. Compressing either latch-bolt 
retracts the opposite latch also. The cylinder is 
shown in the “Unlocked” position. Right rotation of 
the plug locks the Press Button. (See Figure 15.) 


This shows the glove box lock, in the dash. The 
Press Button causes the Plunger to rise out of the 
Latch Strike when it is depressed. When the glove 
box is locked, the Press Button is prevented from 
being pushed down. When the Plunger rises, it 
compresses both spring latches on the glove box 
lid. The lid will spring open and allow access. (See 
Figure 16.) 


The lock assembly is attached to a metal 
framework behind the dash by two Philips Head 


sheet metal screws. The location of the screws is 
indicated in the photo. A cover conceals the Access 
Hole in the left side of the glove box. Remove the 
cover to reach behind the dash and remove the 
two attachment screws. This will require a stubby 
#2 Philips screwdriver and a ratcheting offset 
screwdriver. It’s a tight squeeze, but it can be done. 
Remove the Latch Strike before you begin. 


When the screws are removed, pull the lock 
assembly forward. Carefully pull out on the plunger, 
as you rotate the lock assembly to the right It will 
come out easily. Nothing has to be bent, pried or 
distorted. It’s kind-of a puzzle, but it comes out 
easily. 


This is the Latch Strike. These little plastic pieces 
are surprisingly difficult to remove. Pry down at the 
top of the Latch Strike to dislodge the Top and Rear 
“Small Latch Ears.” The Strike will tilt out of its hole 
as you lift it to dislodge the Bottom Larger Latch ear. 
Replace by hooking the bottom ear into the hole and 
tilting it into place to engage the top and rear latch 
ears. This will prevent damage to the strike. (See 
Figure 17.) 


This shows the Glove Box Lock. The Press 
Button actuates the Plunger. Screw Holes at the 
rear accept the attachment screws, to secure the 
lock to the “metal dash frame.” The Cylinder Plug is 
retained in the assembly by the Plug Retainer. This 
retainer can only be depressed in the “Unlocked” 
position. If the cylinder is in the locked position 
it must be picked “left” to the unlocked position. 


15. 


16. 


17. 
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There are five active tumblers in this lock. (See 
Figure 18.) 


The plastic Cylinder Trim Piece (next photo) is 
secured to the lock by three trim catches. Pry up 
the top catches (2) then pry down the single catch 
at the bottom to release and remove the trim cover. 
Depress the Plug retainer to slide the cylinder out of 
the Lock Mechanism. 


An Exploded View of the Glove Box Lock. The 
components are: The Trim, the Plug, The Cylinder 


Cage, the Retainer and the Lock Mechanism. 
The Retainer must be removed to allow the Plug 
to be slid out of the Cylinder Cage. The wafers 
are marked with the “coded” bitting depths. (See 
Figure 14, to reverse the numbers and find the 
bitting depths) These wafers are “not retained.” 
Disassemble the cylinder carefully. (See Figure 19.) 


The Glove Box cylinder contains wafers in 
positions 7-10 and has a “V” (Valet) wafer that 
engages the “pre-cut” #2 depth at the tip of the 


key. Do not confuse the “Valet” wafer with the 10th 
position of the key. (See Figure 20.) 


Using the above bittings (7-10) and the “missing 
cut” utility of the InstaCode program the code series 
returns one hundred eighty-nine (189) possible 
bitting combinations to complete the key. If we only 
search using positions 3-10, the number falls to 
twenty-four (24) possibilities. This probably is not a 
viable option for completing the key. No code was 
found on this cylinder. 


The ignition cylinder is mounted at the right side 
of the steering column. The two-part column trim 
shell, which surrounds the column, has no obvious 
attachment screws. The shells are held in place by 
two Philips head trim screws “behind the steering 
wheel.” If the Ignition fails, the wheel cannot be 
rotated to access the trim screws. The steering 
wheel will have to be removed. (See Figure 21.) 


Remove the Plastic Trim Cover from the left side 
of the steering wheel trim. This will expose the Air 


18. 


19. 


20. 
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Bag Retaining Screw. A T-30 Torx driver is used 
to remove the screw from the Air Bag frame. The 
screw is retained in the wheel hub by a plastic cage. 
Do not remove the screw from the wheel hub. (See 
Figure 22.) 


Remove the Plastic Trim Cover from the right 
side of the steering wheel trim. Slide the Trim Cover 
up and off the windshield-wiper control arm. This 
will expose the right Air Bag Retaining Screw. A 
T-30 Torx driver is used to remove the screw from 
the Air Bag frame. The screw is retained in the 
wheel hub by a plastic cage. Do not remove the 
screw from the wheel hub. (See Figure 23.) 


Safety First! Disconnect the Battery and allow a 
fifteen-minute wait before attempting to disconnect 
the Air Bag. (See Figure 24.) 


Carefully disconnect the Air Bag control wires. 
The “Safety Lock” connectors have a small plastic 
clip that locks them in position. Raise the clips, 
to release the plugs. Remove the Black and Red 


(Orange) control wires. Disconnect the single black 
“Horn Wire” last. This will free the Air Bag from the 
steering wheel and column. 


Separate the Air Bag and place it in a secure 
area of the vehicle, away from the working area. 
Identifying the various connectors under the air bag. 


23. 


24. 


25. 


26. 
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This vehicle has a number of electrical controls for 
the phone and radio. Disconnect the Steering Wheel 
Control Connectors (2). The control harness will 
stay with the wheel as it is removed. (See Figure 


25.) 


This is the location of the steering wheel Puller 
Bolt Holes. The hub is retained by a 19mm metric 
nut. Use a socket wrench to remove this nut. Use 
a universal wheel puller and metric puller bolts to 
remove the wheel. (See Figure 26.) 


There is no “center punched” Head Marker on 
the tiller shaft or wheel hub. You will notice that 
we have marked the top of the tiller shaft and the 


wheel hub with a Sharpie Marker, to insure accurate 
placement when we reassemble the steering wheel. 
Mark the shaft and wheel hub before you proceed. 


When the wheel is free, lift the wheel and 
carefully feed the Air Bag Control wires through the 
opening in the wheel hub. Set the wheel aside. 


The Column Trim Attachment Screws. Remove 
the screws to free the column trim halves. Do Not 
rotate the Air Bag control “clock spring” plastic 
rotor out of position. (See Figure 27.) 


The column trim halves are locked together by 
“Retaining Stirrup” clips at the left and right sides of 
the shells. The stirrups are on the lower shell half. 
Press inward at the indicated points to unlatch them 
without damage. Release and drop the lower half 
away from the column. The upper shell is attached 
to the dash by leather “light shield.” Hinge it up and 
away from the column, but do not remove it from 
the dash. (See Figure 28.) 


This column has a removable “modular” switch 
for the windshield control switch. Depress the 
Control Lever Release Catch and slide the control 
out of its socket. Allow it to hang from the wire 
harness or unplug it and set it aside. It has been 
removed to allow easier access to the ignition. (See 
Figure 29.) 


27. 
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The Antenna Ring and Amplifier Module is 
attached to the ignition housing by two Stirrup 
Clips. Carefully lift the stirrups off the stirrup rails 
of the ignition housing and slide the Antenna Ring 
off the front of the ignition cylinder. (See Figure 30.) 


The Antenna Ring and Module separated from 
the ignition housing. When replacing the antenna, 
simply slide it over the nose of the ignition and snap 
it in place. No attachment screws are used on this 
antenna. Allow it to hang from the wire harness and 
continue. (See Figure 31.) 


There are three locking electrical connectors 
connected to the ignition housing. They are: the 
large ignition control connector, the white key alarm 
connector and the transmission interlock solenoid 
connector. Release each and remove them from the 
ignition housing. Allow them to hang below the dash 
with the antenna ring and wiper control arm. (See 
Figure 32.) 


The Ignition Housing is attached to the 
steering column post by a saddle strap and a 
single “headless” security bolt. Chase the bolt 
counterclockwise with a prick punch and hammer 
to loosen and remove the screw. The screw head 
modified for reassembly. Slot the screw, as you 
see, and replace it using a large screwdriver or 
screwdriver socket. (See Figure 33.) 


Before we can remove this ignition, we need 
to understand how it operates. The ignition 
cylinder “with no key in the keyway. A “Hook” is 
incorporated into the cylinder body. With no key in 
the keyway, the Hook will be down, as you see in the 
photo. (See Figure 34.) 


When a key is inserted, the front of the Hook is 
pushed away (down), against a spring tension. The 
Hook is levered “up.” The hook is “spring loaded,” 
and not fixed. As the ignition plug is rotated out of 
position, (to the Accessory or On/Run position) the 
steering lock bolt will be pulled up. This is part of 
32. 


33. 


34. 


31. 
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the cam action of the housing. The Hook “captures” 
the steering lock bolt in the “retracted” position. It 
cannot release the bolt until the plug is rotated back 
to the key-pull position and removed. (See Figure 
35.) 


This presents a problem. The key must be in 
the “accessory” position to depress the cylinder 
retainer. Once depressed it will slide out about ½” 
and be prevented from complete removal by the 
Hook engagement with the steering lock bolt. 


To complete the ignition removal, a pick is 
inserted into a separate hole in the housing to lift 
the Hook (push it down) and release the steering 
lock bolt. 


The Ignition Cylinder Retainer hole is located 
under the Antenna Ring Module. We must remove 
the antenna Ring to access the retainer. The 
Transponder Antenna “Clip Rails.” The Cylinder 
Retainer is shown in the access hole. Rotate the 
ignition to the Accessory Position to depress the 


retainer and pull the ignition cylinder out about ½”. 
(See Figure 36.) 


This will bring the port in the side of the ignition 
cylinder into alignment with the access hole in the 
bottom of the ignition housing. The access hole 
is on the bottom of the ignition housing. Insert a 
“straight pick” or “Ice Pick” tool into the access hole 
and pry the hook down “gently.” A “Click” will be 
heard as the spring loaded steering bolt is released. 
The ignition will be free to be removed out the front 
of the housing. (See Figure 37.) 


The Front and Top views of the ignition cylinder. 
The Cylinder Retaining Lug (Pin) is the “active” 
cylinder retainer. It can only be depressed with the 
plug in the accessory position. The Plug Retaining 
Clip retains the Plug in the Cylinder. The Scalp is 
retained by two solid retaining pins. To remove the 
scalp, these pins must be lifted (not Removed) from 
the cylinder body. The drill point is indicated for 
the pin forward of the anti-rattle rubber pad. Drill 
a 3/32” hole through the cylinder case and slightly 
behind center, at the location of the retaining pin. 


36. 
37. 
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Lift the pin using a small sharp “scriber.” A scriber 
point will be harder than an Ice Pick and will dig 
into the side of the pin and lift it easily. If the scriber 
point breaks, replace it. Use the smallest hole and 
do the least damage to the cylinder. The pin socket 
on the opposite side is open to the rear. Use a sharp 
flat blade screwdriver to lift the pin away from the 
cylinder. The Scalp will be free to be removed. (See 
Figure 38.) 


The Rear and Bottom views of the ignition 
cylinder. These views show the Hook Bolt and Hook 
Bolt Spring Retainer. As the key is inserted, the 
front of the Hook Bolt is pushed upward. It actuates 
the Key Alarm switch at the front and prepares the 
hook bolt to capture the steering Lock bolt at the 
rear. This is a very clever mechanism. (See Figure 
39.) 


If the cylinder is damaged or cannot be rotated 
to the accessory position, remove the top of the 
Cylinder Retaining Pin with a carbide burr and 
Dremel Tool. Eat the top of the pin away with the 
burr to free the ignition for removal. Replace the 


ignition or use a socket head “set screw” (Allen 
Screw) in the Ignition Housing to hold the ignition 
in place. Remove and discard the remnant of the 
Cylinder Retaining Lug. 


An Exploded View of the Ignition Cylinder. The 
Scalp Retaining Pins have been raised to allow the 
Scalp to be removed without removing them. A 
Chrome Plug Face Cap is captive between the Scalp 
and the head of the Plug. (See Figure 40.) 


Top and Bottom views of the Ignition Plug. The 
Bottom View shows the metal Key Sensor Slide 
(Block), at the front of the Plug. This Slide lifts the 
front of the Hook Bolt. (See Figure 41.) 


The Ignition Cylinder has 10 wafers, in positions 
1-10. As with all of the cylinders on this vehicle, they 
are “Paired” wafers. 


The Rear Hatch Release Cylinder is mounted 
under the chrome license plate light trim. This 
cylinder has no mechanical connection to the latch 
release. It is an electrical switch only. It enables or 
disables the electric release under the center of the 
same trim piece. If the battery is dead or the latch 


40. 
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release solenoid fails, a plastic trim cover on the 
inside of the hatch can be removed to access the 
rear of the latch mechanism. The latch can then be 
released from inside. (See Figure 42.) 


The Electric Hatch Release Switch is located 
under the center of the license plate light trim. 
When the vehicle is unlocked, the switch will be 
active. When the vehicle is locked, the switch is 
deactivated. (See Figure 43.) 


The Rear Hatch Cylinder is removed through 
the inside of the hatch. The Plastic trim panel is 
secured by 12 friction post catches and one 10mm 
hex head screw, which also attaches the Pull Strap 
to the inside of the Hatch. Remove the plastic trim 
cover beneath the Pull Strap to reveal the 10mm 
attachment Screw. Remove the screw and Pull Strap. 
(See Figure 44.) 


To prevent damage and stress to the wire 
harness the courtesy lamps should be removed 


and disconnected from the door trim before it is 
removed. They are retained by a Metal Spring Clip 
on one side and plastic hook ears on the opposite 
side. Push the spring clip inward to release the 
lamp housing. Tilt it out of the hole and release the 
locking wire connector to separate it from the hatch 
door. Remove both courtesy lamps. (See Figure 45.) 


The rigid plastic trim panel is retained by 12 
Plastic Friction Post Fasteners. Start at the bottom 
right corner of the panel. Pry up and release 
the fasteners. An arrow and design pry point is 
indicated on the outside rim of the trim panel. 
Plastic hooks along the top of the panel hold it in 
place under the glass. Lift the trim to free it from 
the Hatch Door. Here you see the underside of the 
trim panel and the locations of the Friction Post 
Fasteners. (See Figure 46.) 


Carefully separate the plastic moisture seal from 
the inside of the hatch frame to reveal the Hatch 
Lock Cylinder. The cylinder is attached by two 


44. 
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10mm Attachment screws. Carefully remove the 
electric switch from the rear of the lock cylinder. 
Note that there is no mechanical lock linkage from 
this cylinder to the latch. Remove the 10mm hex 
nuts to disassemble the lock cylinder from the hatch 
body. (See Figure 47.) 


This shows all views of the Rear Hatch Cylinder. 
Remove the Plug Retaining Clip, Washer and 
Centering Spring. Hold the cylinder in one hand, 
with the cylinder cap facing up. Bring it down 
sharply on a padded surface to dislodge and remove 


the cylinder cap. It’s easier than trying to pry the 
cap off, and will not damage the cylinder. Be careful 
not to eject the plug from the cylinder, as the wafers 
“are not retained.” Alternately, you can carefully 
pry up and remove the cap. The cap is an “easy-off” 
design, and will be reused when we reassemble the 
cylinder. (See Figure 48.) 


The Hatch Cylinder Components in an exploded 
view. (See Figure 49.) 


The Hatch Cylinder Plug detail. There are eight 
(8) wafers in positions 3-10. The wafer compartment 


47. 
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at the rear of the plug 
would accommodate a 
“V” (Valet) wafer. This 
cylinder had no wafer in 
the Valet position. (See 
Figure 50.) 


This is the OEM 
Toyota IKT head key. 
This is a three button 
remote. The FCC ID 
information is shown 
above the key. The key 
will be blade marked 
“G.” This transponder is 
used in a number of other 
Toyota vehicles, but the 
IKT section is unique 
to the 2010-13 4Runner 
and 2011-13 RAV4. (See 
Figure 51.) 


Transponder Programming 


This vehicle uses a Texas Instruments 64 Bit 
Encrypted transponder system. 


• Keys must be “Blade Marked” G. No other keys 
will substitute. 


• The Dealer “G” key is Part Number 89785- 
08040. 


• Advanced Diagnostics T-Code and MVP Pro, 
use software ADS-174. 


• The 4Runner to 2013 uses the Type 5 system. 


• PIN number is required with dealer tool. 


• There is no OBP (Onboard Programming 
Procedure), that I know of. 


• Clone, using the ILCO RW4 Plus and EK3- 
TOY43 or EK3LB-TOY43 key. 


This vehicle was a pleasure to service, and should 
pose no special problems for the professional 
locksmith. 


“With the right tools, and the right training, 
they’re all easy.” 


n 
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